MSN Virus? Worm? Trojan?

[Barewolf]

My mate has MSN 8.1 on XP and she has some kind of wacky Virus or trojan affecting her MSN.

She closes all the IM windows and goes invisible but the computer is still running and so is MSN. BUT.

When she comes back to the PC there is an outline of an IM window, It appears MSN has been sending random messages to people in the contact list, Like.......

Woooooooooooow Fantastic

And

Hey Sexy

She didnt send them and its becoming stressful to her, which is not good as she is 28 weeks pregnant and already depressed.

I have searched for a solution but came up with nothing that matches, I presume she isnt the 1st to be infected with this, I would appreciate any help here as she relies on MSN alot. You know what women are like.

[Help!!!]

I have seem a few of my msn contacts with this, typical Trojan "Do you like my picture" then sends you a file in a zip folder which is a Trojan, then when you open it it infects your computer and sends it self to all your contacts.

Try this, its a free virus remover, if you know where to look you could get NOD32 fantastic program that I use.

[Barewolf]

Have they managed to get rid of theirs?

[Help!!!]

I have no idea mate, i told them they had a virus, they just said ok ill get it sorted, don't think they are computer technical, they tried to change accounts, but that obviously don't work as its infected on your computer, so a free virus scan in safe mode should deal with the problem.

Google there are many good free virus removers, avg for example or the link I gave you.

[Barewolf]

Hmmm, Well she ran scans and deleted something but still no luck. I use Panda so im safe usually, never used NOD32 but passed the link.

Wish hackers would do something usefull like protect peoples pc's not try and destroy them, more importand crap going on in the world with terrorism and global warming, last people need is some lamer causing havok.

[r00t]

Give these a bash.
http://housecall.trendmicro.com/
http://www.kaspersky.com/scanforvirus
http://www.bitdefender.com/scan8/ie.html
Online scanners they may save you/her time installing software.

[PeteTheMusicGuy]

A mate of mine seems to have the same thing and cant get rid of it. Does anyone know the name of this virus so I can go looking for a removal tool for her as it seems her anti virus is not picking it up

[r00t]

Ask them to run Hijackthis We should be able to see whats running that shouldn't be.

[PeteTheMusicGuy]

Great I'll get her to that this evening and post it when she sends to me

[Barewolf]

i cracked it, system restore to the point before it happened, scans dont work, UNLESS someone knows of one that will work, all the ones she tried here and my suggestions didnt work but restore 2 weeks did.

NEVER OPEN A ZIP FILE

[PeteTheMusicGuy]

being doing some looking into it wondering if it might be this This

[Barewolf]

Thanks pete, looks like the one to me, not sure how many versions are out there but job well done, rated you for that fella.

[AndrewJ]

I think I am infected by this, at times the pc locks up and random windows open and close, quicker than I can see what they're doing.

Scans with Adaware and Spybot and AVG comes up with nothing.

[Druchii]

I can chuck together a quick removal tool if i get the chance, seen as nothing seems to be picking it up yet, seems trivial to do.

Well, after i've installed Visual Studio once again that is... Hang tight, i'll think of something

[Druchii]

Ok, and here's a fix, runs perfectly on windows XP, should on Win2k.

Compromises of a small batch script and reg file

Anyone can take a look, open them in notepad to see
You should select Yes to the question of adding things to the registry, it's actually deleting the autorun key.

Please note, you'll need to extract and place both files in the same folder, otherwise they will not run correctly.